Shameless plug: I created a Golang utility to scrub passwords from a deeply nested struct, before logging, at Nutanix some time back [0][1]. We also run an automated test to try out all operations with a known password, and then ensuring that it is not present in any of the log files.